feat(ci): build the image on Forgejo CI to the in-cluster registry, retire the GitHub Actions -> Docker Hub path #23

New issue

Closed

opened 2026-07-07 04:43:17 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-07-07 04:43:17 +00:00

Owner

Why

lunch-money-k8s is the fleet outlier. Its image builds on GitHub Actions (.github/workflows/docker.yml) and publishes to docker.io/coilysiren/lunch-money-k8s. Every other coilyco-source MCP in the deploy fleet (node-stats-mcp, reddit-mcp, steam-mcp) builds on Forgejo CI and publishes straight to the in-cluster registry 192.168.0.194:30500, so their deploy bundles need zero hand-mirror. lunch-money's bundle (deploy/services/lunch-money-mcp, deploy#50) has to hand-mirror the Docker Hub tag into the in-cluster registry as a one-time operator prereq, purely because the image lands in the wrong registry. It is also inconsistent with the Forgejo-canonical / GitHub-is-a-PR-mirror model the rest of the org follows.

Do (this repo)

Add a .forgejo/workflows/ image build that builds and pushes 192.168.0.194:30500/lunch-money-mcp:<tag>, matching the node-stats-mcp / reddit-mcp source-repo pattern - read one of those repos' .forgejo/workflows/ as the template (same in-cluster-registry push creds + tag scheme). Tag with the short-sha scheme the deploy bundle pins (sha-<short>) plus latest.
Retire .github/workflows/docker.yml (the Docker Hub publish). Keep GitHub as the PR mirror only - no image build there.
Leave .github/workflows/ci.yml (tests) unless the template repos run tests on fj CI too, in which case match the house pattern.

Companion (deploy repo - file as a follow-up, do not do here)

Once this lands, deploy/services/lunch-money-mcp should drop the hand-mirror operator prereq and source the image directly from the in-cluster registry like reddit/steam: update values.env and the README operator-prereqs (remove the skopeo mirror step). File that against coilyco-bridge/deploy referencing this issue - do not touch the deploy repo from this run.

Acceptance

A push to lunch-money-k8s builds + pushes 192.168.0.194:30500/lunch-money-mcp:sha-<short> via Forgejo CI.
.github/workflows/docker.yml is gone; no image publishes to Docker Hub.
The deploy-repo follow-up issue is filed.

Not urgent

Kai: "we don't actually need it up now." lunch-money-mcp does not need to be serving. This is the build-path correction, not the deploy roll.

Triage

Intended P2, headless - self-contained CI change with an in-repo template (node-stats-mcp / reddit-mcp).

## Why lunch-money-k8s is the fleet outlier. Its image builds on **GitHub Actions** (`.github/workflows/docker.yml`) and publishes to `docker.io/coilysiren/lunch-money-k8s`. Every other coilyco-source MCP in the deploy fleet (node-stats-mcp, reddit-mcp, steam-mcp) builds on **Forgejo CI** and publishes straight to the in-cluster registry `192.168.0.194:30500`, so their deploy bundles need zero hand-mirror. lunch-money's bundle (`deploy/services/lunch-money-mcp`, deploy#50) has to hand-mirror the Docker Hub tag into the in-cluster registry as a one-time operator prereq, purely because the image lands in the wrong registry. It is also inconsistent with the Forgejo-canonical / GitHub-is-a-PR-mirror model the rest of the org follows. ## Do (this repo) 1. **Add a `.forgejo/workflows/` image build** that builds and pushes `192.168.0.194:30500/lunch-money-mcp:<tag>`, matching the **node-stats-mcp / reddit-mcp** source-repo pattern - read one of those repos' `.forgejo/workflows/` as the template (same in-cluster-registry push creds + tag scheme). Tag with the short-sha scheme the deploy bundle pins (`sha-<short>`) plus `latest`. 2. **Retire `.github/workflows/docker.yml`** (the Docker Hub publish). Keep GitHub as the PR mirror only - no image build there. 3. Leave `.github/workflows/ci.yml` (tests) unless the template repos run tests on fj CI too, in which case match the house pattern. ## Companion (deploy repo - file as a follow-up, do not do here) Once this lands, `deploy/services/lunch-money-mcp` should drop the hand-mirror operator prereq and source the image directly from the in-cluster registry like reddit/steam: update `values.env` and the README operator-prereqs (remove the skopeo mirror step). File that against `coilyco-bridge/deploy` referencing this issue - do not touch the deploy repo from this run. ## Acceptance - A push to lunch-money-k8s builds + pushes `192.168.0.194:30500/lunch-money-mcp:sha-<short>` via Forgejo CI. - `.github/workflows/docker.yml` is gone; no image publishes to Docker Hub. - The deploy-repo follow-up issue is filed. ## Not urgent Kai: "we don't actually need it up now." lunch-money-mcp does **not** need to be serving. This is the build-path correction, not the deploy roll. ## Triage Intended **P2**, **headless** - self-contained CI change with an in-repo template (node-stats-mcp / reddit-mcp).

coilyco-ops commented

2026-07-07 04:43:35 +00:00

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-lunch-money-k8s-23 on host KAI-DESKTOP-TOWER is carrying this issue (reserved 2026-07-07T04:43:30Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/lunch-money-k8s#23 · branch issue-23 · driver claude · workflow direct-main
Run: engineer-claude-lunch-money-k8s-23 · ward v0.417.0 · dispatched 2026-07-07T04:43:30Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Issue body as seeded:

## Why

lunch-money-k8s is the fleet outlier. Its image builds on **GitHub Actions** (`.github/workflows/docker.yml`) and publishes to `docker.io/coilysiren/lunch-money-k8s`. Every other coilyco-source MCP in the deploy fleet (node-stats-mcp, reddit-mcp, steam-mcp) builds on **Forgejo CI** and publishes straight to the in-cluster registry `192.168.0.194:30500`, so their deploy bundles need zero hand-mirror. lunch-money's bundle (`deploy/services/lunch-money-mcp`, deploy#50) has to hand-mirror the Docker Hub tag into the in-cluster registry as a one-time operator prereq, purely because the image lands in the wrong registry. It is also inconsistent with the Forgejo-canonical / GitHub-is-a-PR-mirror model the rest of the org follows.

## Do (this repo)

1. **Add a `.forgejo/workflows/` image build** that builds and pushes `192.168.0.194:30500/lunch-money-mcp:<tag>`, matching the **node-stats-mcp / reddit-mcp** source-repo pattern - read one of those repos' `.forgejo/workflows/` as the template (same in-cluster-registry push creds + tag scheme). Tag with the short-sha scheme the deploy bundle pins (`sha-<short>`) plus `latest`.
2. **Retire `.github/workflows/docker.yml`** (the Docker Hub publish). Keep GitHub as the PR mirror only - no image build there.
3. Leave `.github/workflows/ci.yml` (tests) unless the template repos run tests on fj CI too, in which case match the house pattern.

## Companion (deploy repo - file as a follow-up, do not do here)

Once this lands, `deploy/services/lunch-money-mcp` should drop the hand-mirror operator prereq and source the image directly from the in-cluster registry like reddit/steam: update `values.env` and the README operator-prereqs (remove the skopeo mirror step). File that against `coilyco-bridge/deploy` referencing this issue - do not touch the deploy repo from this run.

## Acceptance

- A push to lunch-money-k8s builds + pushes `192.168.0.194:30500/lunch-money-mcp:sha-<short>` via Forgejo CI.
- `.github/workflows/docker.yml` i

… (truncated to 2000 chars; full body is on this issue)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.417.0).

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-lunch-money-k8s-23` on host `KAI-DESKTOP-TOWER` is carrying this issue (reserved 2026-07-07T04:43:30Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/lunch-money-k8s#23` · branch `issue-23` · driver `claude` · workflow `direct-main` - **Run:** `engineer-claude-lunch-money-k8s-23` · ward `v0.417.0` · dispatched `2026-07-07T04:43:30Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). **Issue body as seeded:** ``` ## Why lunch-money-k8s is the fleet outlier. Its image builds on **GitHub Actions** (`.github/workflows/docker.yml`) and publishes to `docker.io/coilysiren/lunch-money-k8s`. Every other coilyco-source MCP in the deploy fleet (node-stats-mcp, reddit-mcp, steam-mcp) builds on **Forgejo CI** and publishes straight to the in-cluster registry `192.168.0.194:30500`, so their deploy bundles need zero hand-mirror. lunch-money's bundle (`deploy/services/lunch-money-mcp`, deploy#50) has to hand-mirror the Docker Hub tag into the in-cluster registry as a one-time operator prereq, purely because the image lands in the wrong registry. It is also inconsistent with the Forgejo-canonical / GitHub-is-a-PR-mirror model the rest of the org follows. ## Do (this repo) 1. **Add a `.forgejo/workflows/` image build** that builds and pushes `192.168.0.194:30500/lunch-money-mcp:<tag>`, matching the **node-stats-mcp / reddit-mcp** source-repo pattern - read one of those repos' `.forgejo/workflows/` as the template (same in-cluster-registry push creds + tag scheme). Tag with the short-sha scheme the deploy bundle pins (`sha-<short>`) plus `latest`. 2. **Retire `.github/workflows/docker.yml`** (the Docker Hub publish). Keep GitHub as the PR mirror only - no image build there. 3. Leave `.github/workflows/ci.yml` (tests) unless the template repos run tests on fj CI too, in which case match the house pattern. ## Companion (deploy repo - file as a follow-up, do not do here) Once this lands, `deploy/services/lunch-money-mcp` should drop the hand-mirror operator prereq and source the image directly from the in-cluster registry like reddit/steam: update `values.env` and the README operator-prereqs (remove the skopeo mirror step). File that against `coilyco-bridge/deploy` referencing this issue - do not touch the deploy repo from this run. ## Acceptance - A push to lunch-money-k8s builds + pushes `192.168.0.194:30500/lunch-money-mcp:sha-<short>` via Forgejo CI. - `.github/workflows/docker.yml` i ``` … (truncated to 2000 chars; full body is on this issue) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.417.0). </details>  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-07-07 04:50:45 +00:00

feat(ci): build image on Forgejo CI to the in-cluster registry

coilysiren closed this issue

2026-07-07 04:50:45 +00:00

coilysiren commented

2026-07-07 04:52:48 +00:00

Author

Owner

WARD-OUTCOME: done - .forgejo/workflows/build-publish.yml builds+pushes 192.168.0.194:30500/lunch-money-mcp:sha-+latest; .github docker.yml and ci.yml retired; deploy follow-up filed as coilyco-bridge/deploy#56.

Straightforward once I had the template in hand. The two source repos (node-stats-mcp, reddit-mcp) aren't in /substrate, so I sparse-cloned reddit-mcp's .forgejo/ off Forgejo to copy the battle-tested docker-CLI-install + DinD-host-probe publish steps verbatim rather than reinvent them.

Two things fought back. First, the templates tag with the full github.sha and run no helm, but this repo's deploy bundle pins sha-<short> and this repo carries a Helm chart - so I diverged deliberately: a cut -c1-7 short-sha + latest, and a helm job the pure-MCP templates don't need. Second, this repo's code-comments hook is stricter than the template repos': it rejects any YAML comment below the first content line, so I had to hoist the whole header block above name: and push the step-by-step narration into docs/deploy.md (which then tripped the 80-line doc cap and needed trimming). The templates themselves would fail this repo's own gate, which is a mild fleet inconsistency worth noting.

Confidence: high on the retirement + tag scheme (tests/ruff/helm-lint green locally, all pre-commit hooks pass). Medium on the publish job actually going green on the first real Forgejo run - I copied the DinD probe faithfully but couldn't exercise it here, and azure/setup-helm@v4 resolving on the fj runner is assumed-good from the setup-uv precedent, not verified. Worth watching the first main-push CI run.

Rough edge / follow-up beyond #56: the Helm chart default image.repository still points at docker.io/coilysiren/lunch-money-k8s, which will no longer receive builds. Left it alone (the in-cluster RFC1918 registry is a poor public chart default, and it's out of this issue's scope), but a chart-default decision is worth a separate think.

Self-inflicted: I fat-fingered a second issue create while probing the CLI and created a junk deploy#57 - retitled and closed it, real follow-up is #56.

Claude (she/her)

WARD-OUTCOME: done - .forgejo/workflows/build-publish.yml builds+pushes 192.168.0.194:30500/lunch-money-mcp:sha-<short>+latest; .github docker.yml and ci.yml retired; deploy follow-up filed as coilyco-bridge/deploy#56. Straightforward once I had the template in hand. The two source repos (node-stats-mcp, reddit-mcp) aren't in /substrate, so I sparse-cloned reddit-mcp's .forgejo/ off Forgejo to copy the battle-tested docker-CLI-install + DinD-host-probe publish steps verbatim rather than reinvent them. Two things fought back. First, the templates tag with the full `github.sha` and run no helm, but this repo's deploy bundle pins `sha-<short>` and this repo carries a Helm chart - so I diverged deliberately: a `cut -c1-7` short-sha + `latest`, and a helm job the pure-MCP templates don't need. Second, this repo's code-comments hook is stricter than the template repos': it rejects any YAML comment below the first content line, so I had to hoist the whole header block above `name:` and push the step-by-step narration into docs/deploy.md (which then tripped the 80-line doc cap and needed trimming). The templates themselves would fail this repo's own gate, which is a mild fleet inconsistency worth noting. Confidence: high on the retirement + tag scheme (tests/ruff/helm-lint green locally, all pre-commit hooks pass). Medium on the publish job actually going green on the first real Forgejo run - I copied the DinD probe faithfully but couldn't exercise it here, and azure/setup-helm@v4 resolving on the fj runner is assumed-good from the setup-uv precedent, not verified. Worth watching the first main-push CI run. Rough edge / follow-up beyond #56: the Helm chart default image.repository still points at docker.io/coilysiren/lunch-money-k8s, which will no longer receive builds. Left it alone (the in-cluster RFC1918 registry is a poor public chart default, and it's out of this issue's scope), but a chart-default decision is worth a separate think. Self-inflicted: I fat-fingered a second `issue create` while probing the CLI and created a junk deploy#57 - retitled and closed it, real follow-up is #56. - Claude (she/her)